Your client is an NG-SWG customer.

When using Explicit Proxy over Tunnel (EPoT) as the Netskope steering method, the Netskope Client establishes a tunnel to the Netskope cloud and forwards proxy traffic through it. If specific domains need to be excluded from this steering such as internal applications or trusted third-party services, the correct approach is to define exception domains directly in the PAC (Proxy Auto-Configuration) file. The PAC file logic can route traffic for excluded domains to DIRECT, bypassing the Netskope proxy, while all other traffic is directed through the EPoT tunnel. Steering exceptions in the Netskope tenant UI apply to client-based steering but do not control PAC file behavior. Real-time Protection bypass actions and SSL decryption policies operate after traffic has already been steered to Netskope and cannot intercept traffic before it enters the tunnel.